KR102059688B1 - Cyber blackbox system and method thereof - Google Patents

Abstract

A cyber black system is disclosed. The system includes a data collector for collecting entire packet data, flow data, and portable executable files from monitored network traffic, and the collected cyber packet incidents based on the collected total packet data, flow data, and PE files. A server for analyzing the cause and reproducing the cyber infringement incident.

Description

Cyber black box system and method thereof {CYBER BLACKBOX SYSTEM AND METHOD THEREOF}

The present invention relates to a cyber black box system and a method thereof, and more particularly, to a cyber black box system and a method for analyzing the cause of a cyber infringement incident and collecting evidence data on the cyber infringement incident. .

Cyber infringement incidents (hereinafter referred to as infringement incidents) in the field of network security include cyber attacks that attack the telecommunications network or related information systems by hacking, computer viruses, logical bombs, e-mail bombs, denial of service or high-power electromagnetic waves. Say the situation.

Since the conventional cyber attack is mainly focused on log analysis, there is a limit to rapid cause analysis and post response. Moreover, after the breach occurred, it is difficult to analyze the cause of the attack because there is no log information necessary to analyze the cause of the attack. That is, even after recognizing the infringement accident, the cause of the attack cannot be known, so there is a limit in the post-response.

In addition, evolved cyber attacks, such as Advanced Persistent Threats (APTs), require more than a few months of root cause analysis and are difficult to detect with traditional security devices.

Accordingly, it is an object of the present invention to provide a cyber black box system and a method capable of promptly analyzing the cause of an infringement incident and providing a collection function of evidence data on the infringement incident.

According to an aspect of the present invention, there is provided a method of collecting evidence data for a cyber infringement incident, extracting entire packet data from monitored network traffic, and extracting the entire packet data for each IP, port, and protocol. Analyzing and extracting a bundle of packet data having the same characteristics as flow data, extracting a bundle of packet data having a Portable Executable (PE) format from the extracted entire packet data into a PE file, and Temporarily storing the entire packet data, the flow data, and the PE file in a buffer, generating a hash value by applying a hash function to each of the temporarily stored total packet data, the flow data, and the PE file; The generated hash value, the temporarily stored total packet data, and the flow Storing the data and the PE file as the evidence data in a storage unit.

According to another aspect of the present invention, a cyber black system includes a data collector for collecting entire packet data, flow data, and portable executable files from monitored network traffic, and the collected total packet data, flow data, and PE files. And analyzing the cause of the cyber infringement based on the server and reproducing the cyber infringement incident.

According to the present invention, the present invention solves the limitations of the conventional technology for responding to cyber attacks by preserving the evidence data collected from the network traffic for a long time and ensuring the integrity of the collected evidence data, and proof of the infringement accident. It can enable data collection and rapid cause analysis.

1 is a block diagram schematically showing the internal configuration of a black box system according to an embodiment of the present invention.
FIG. 2 is a diagram schematically showing evidence data collected by the data collector illustrated in FIG. 1.
FIG. 3 is a block diagram schematically illustrating an internal configuration of the data collector illustrated in FIG. 1.
4 is a block diagram schematically illustrating an internal configuration of the server illustrated in FIG. 1.
FIG. 5 is a flowchart illustrating a process of collecting and storing preserved data included in evidence data performed by the data collector illustrated in FIG. 2.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, advantages and features of the present invention, and methods of achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings.

However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, and only the following embodiments are provided to those skilled in the art to which the present invention pertains. It is merely provided to easily inform the configuration and effects, the scope of the present invention is defined by the description of the claims.

Meanwhile, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and / or “comprising” refers to the presence of one or more other components, steps, operations and / or devices in which the mentioned components, steps, operations and / or devices are described. Or does not exclude addition.

FIG. 1 is a block diagram schematically showing an internal configuration of a black box system according to an embodiment of the present invention, and FIG. 2 is a diagram schematically showing evidence data collected by the data collector shown in FIG. 1.

Referring to FIG. 1, the black box system 300 according to an embodiment of the present invention infringes by using the data collector 100 collecting evidence data and the evidence data collected by the data collector 100. It includes a server 200 for analyzing and reproducing the cause of the accident.

The evidence data 11 collected by the data collection unit 100 includes management data 13 and preservation data 15, as shown in FIG. 2.

The management data 13 includes summary data 13A indexing the preservation data 15 and system log data 13B indicating the resource status of the data collection unit 100.

Unlike the management data 13, the save data 15 is data set to be stored for a long time in the data collection unit 100, and includes all network packet data 15A (hereinafter, all packet data) constituting the network traffic. Flow data 15B extracted from the entire packet data 15A, a portable executable file (PE) 15C extracted from the entire packet data 15A, and metadata associated with the PE file 15C ( 15D). The preservation data 15 may further include a hash value that guarantees the integrity of each of the entire packet data 15A, the flow data 15B, and the portable executable file PE. Here, the PE file is an executable file that is executed in the Windows operating system, for example, a file having an extension of cp, exe, dll, ocx, vxd, sys, scr, drv, or the like.

When an infringement occurs, the server 200 requests the data collection unit 100 for evidence data 11 collected by the data collection unit 100, and the data collection unit 100 according to the request. It is configured to reproduce the cause of the breach and the cyber attack causing the breach using the evidence data 11 received from the. In addition, the server 200 may be configured to provide an analysis result of analyzing the cause of the breach to an external cyber security control system (not shown).

Hereinafter, the data collection unit 100 shown in FIG. 1 will be described in detail.

FIG. 3 is a block diagram schematically illustrating an internal configuration of the data collector illustrated in FIG. 1.

Referring to FIG. 3, the data collector 100 according to an exemplary embodiment may include a network packet mirroring unit 111, a packet extraction unit 113, a flow data extraction unit 115, and a PE file extraction unit 117. ), A buffer 119, a hash value generating unit 121, a management data generating unit 123, an encoding unit 125, and a storage unit 127.

The network packet mirroring unit 111 is a configuration for monitoring network traffic and may be a network communication device such as a network interface card (NIC).

The network packet mirroring unit 110 monitors network traffic using a packet mirroring scheme. Packet mirroring is also called port mirroring. Port mirroring means copying all network traffic seen on one port of the NIC to another monitoring port of the NIC.

The packet extracting unit 113 extracts the entire packet data from the network traffic replicated by the network packet mirroring unit 110. The extracted whole packet data is temporarily stored in the buffer 119. In this case, the extracted whole packet data may be bundled in a specific file form in a predetermined time unit and temporarily stored in the buffer 119. In this case, the specific file type may be a file having a packet capture (PCAP) format.

The flow data extractor 115 extracts flow data from all packet data extracted by the packet extractor 113. As a method of extracting flow data, for example, all packet data extracted by the packet extracting unit 113 are analyzed for each IP, port, and protocol to collect packet data having the same characteristics in units of a predetermined time, and collected in units of a predetermined time. The collected packet data into a specific file of the PCAP format to extract one flow data (or flow packet).

As another method of extracting flow data, flow data may be extracted by sampling a predetermined ratio of packets among all packet data by using a deterministic packet sampling scheme.

The extracted flow data is temporarily stored in the buffer 119.

The PE file extractor 117 extracts a PE file from all packet data extracted by the packet extractor 113. For example, the PE file extractor 117 selects packets having PE file information (or PE format) in all packet data extracted by the packet extractor 113, and collects all packets having the selected PE file information. Then, all packets with the collected PE file information are extracted by reassembling (or reconfiguring) into one PE file. The extracted PE file is temporarily stored in the buffer 119. In addition, the PE file extractor 117 may generate metadata about the extracted PE file.

The hash value generator 121 generates a hash value by applying a hash function to each in order to ensure data integrity of each of packet data, flow data, and PE file stored in the buffer 119. The generated hash value is stored in the storage unit 127 and stored for a long time.

The management data generation unit 123 generates management data including summary data and system log data as shown in FIG. 2.

The summary data is data summarizing each of the entire packet data, the flow data, and the PE file classified as the preservation data shown in FIG. When storing the detection time, the IP address estimated by the cyber attack, the entire packet data, the flow data, and the PE file in the form of a file, each file name information may be included.

Such summary data may be transferred to the server 200 and used as statistical information. When the summary data is used as statistical information, the statistical information may be used as information that visually provides the server administrator with the status and trend of abnormal / harmful traffic generation through a GUI provided in the server 200. In addition, the summary data may be used as an indexing value for searching the corresponding data when searching the entire packet data, the flow data, and the PE file in the server 200.

The system log data is data representing a system state of the data collecting unit 100, and means data indicating, for example, utilization rates of the CPU, memory, and disk constituting the data collecting unit 100.

Management data including such summary data and system log data may be periodically reported at the request of the server 200. This reporting period may be set by the server 200.

The encoding unit 125 encodes the entire packet data, the flow data, and the PE file stored in the file in the PCAP format in the buffer 119.

The storage unit 127 stores the entire packet data, the flow data, and the PE file encoded in the file unit by the encoding unit 125 as storage data. In addition, the storage unit 127 may receive the hash value for each packet data, flow data, and PE file generated by the hash value generator, and store the hash value as evidence data. In addition, the storage unit 127 may receive meta data about the PE file generated by the PE file extraction unit and store it as evidence data.

The storage unit 127 may be a storage supporting a write once read many (WORM) function. The storage unit 127 supporting the WORM function may be understood as a storage medium that writes only once and reads only several times, such as a CD-ROM. Therefore, the storage unit 127 may store the entire packet data, the flow data, and the PE file for a long time.

The entire packet data, flow data, and PE file encoded in the file unit stored in the storage unit 127 are provided to the server 200 at the request of the server 200. That is, in the event of an infringement or other necessary situation, the entire encoded packet data, flow data, and PE file contain at least one of management data and preservation data for the purpose of analyzing and reproducing the cause of the infringement. The data is provided to the server 200.

Hereinafter, the server 200 shown in FIG. 1 will be described in detail.

4 is a block diagram schematically illustrating an internal configuration of the server illustrated in FIG. 1.

Referring to FIG. 4, the server 200 analyzes the cause of the infringement accident using the evidence data provided from the data collecting unit 100 and reproduces the cause of the infringement accident.

To this end, the server 200 includes a management data collector 210, a decoder 220, a cause analysis and reproduction unit 230, and an external system interworking unit 240.

The management data collector 210 receives management data according to a request for management data of the cause analysis and reproduction unit 230 below and collects the management data. In this case, the management data may be periodically collected and collected according to the report period set by the cause analysis and reproducing unit 230 without a special request.

The decoding unit 220 receives the entire packet data, the flow data, the PE file, and the metadata associated with the PE file, which are stored (or preserved) in an encoded state in the storage unit 127 of the data collection unit 100, Decode them.

The cause analyzing and reproducing unit 230 collects the data including the decoded entire packet data, the flow data, the PE file, and the management data including the summary data and the system log data including the preservation data including the meta data related to the PE file. ) Can be requested.

In detail, the cause analysis and reproducing unit 230 accesses the storage unit 127 of the data collection unit 100 to retrieve the corresponding preservation data indexed to the summary data, and when the preservation data is retrieved, the retrieved preservation data is retrieved. request.

When the cause analysis and reproducing unit 230 receives the retrieved corresponding preserved data on request, the cause analysis and reproduction unit 230 analyzes the cause of the infringement accident using the received stored data and reproduces the cyber attack causing the infringement accident.

The cause analysis and reproducing unit 230 may provide a variety of visual information to a provider through a GUI through the analysis result analyzing the cause of the infringement accident.

Reproduction of cyber attacks is based on evidence data collected at the time of cyber attack, extracting cyber attack scenarios such as attack time, attacked IP address, and constructing attack scenarios based on the extracted information. The incident can be reproduced accordingly.

On the other hand, the cause analysis result of the infringement incident may be provided to the external system through the external interlocking system 240. The cause analysis result may be limited in its provision to be provided to an authorized external system. That is, the external interworking system 240 may set a security level on the external system, and may grant appropriate authority according to the set security level. The external system may be a supplementary related system provided in a security company, a public institution, a portal company, or a general company.

FIG. 5 is a flowchart illustrating a process of collecting and storing preserved data included in evidence data performed by the data collector illustrated in FIG. 2.

Referring to FIG. 5, first, the packet extracting unit 113 collects evidence data including entire packet data, flow data, and PE files from network traffic monitored by the packet mirroring unit 111. This is performed (S510). The collected evidence data is temporarily stored in the buffer 119.

Subsequently, a process of determining whether a collection time of evidence data stored in a buffer satisfies a preset storage time is performed (S520).

When the collection time of the evidence data reaches the preset collection time, the process proceeds to the next step S530. If the collection time does not reach, the collection of the evidence data is continued until the preset storage time is reached. When the collection time of evidence data is set in one minute unit, the evidence data collected in real time in the buffer 119 is bundled in one minute unit. In this case, the bundle of evidence data bundled in one minute unit is stored in a specific file such as PCAP format.

Subsequently, a process of generating a hash value is performed in order to ensure data integrity of the evidence data collected during a preset collection time (S530).

Subsequently, a process of encoding the evidence data collected for a predetermined collection time in units of the specific file is performed (S540).

Subsequently, the encoded evidence data and the generated hash value are stored in a storage unit supporting the WORM function (S550).

Thereafter, if there is no data to process in the buffer 119, all the processes related to the collection and storage process of the preservation data included in the evidence data are terminated.

In the embodiment of FIG. 5, the collection and storage process of the preservation data of FIG. 2 has been described. However, the collection and storage process of FIG. 5 may be equally applied to the management data of FIG. 2 according to a design.

As described above, the response to the conventional cyber attack takes several months or more to analyze the cause of the infringement incident, and since the information necessary for analyzing the cause of the infringement is not left, the cause of the invasion was not known even after the infringement incident was recognized. The present invention collects entire packet data, flow data, and PE files from network traffic as evidence data and stores them in a storage medium capable of long-term preservation, thereby promptly identifying the cause of an infringement incident based on the evidence data stored in the storage medium. Can be analyzed.

Those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

Claims (15)

In the method of collecting evidence data on the cyber incident,
Extracting full packet data from the monitored network traffic;
Analyzing packet data having the same characteristics as flow data by analyzing the extracted packet data for each IP, port, and protocol;
Extracting a bundle of packet data having a Portable Executable (PE) format from the extracted entire packet data into a PE file;
Temporarily storing the extracted entire packet data, the flow data, and the PE file in a buffer and collecting the extracted packet data;
Generating a hash value by applying a hash function to each of the temporarily stored total packet data, the flow data, and the PE file; And
Storing the generated hash value, the temporarily stored total packet data, the flow data, and the PE file as the evidence data in a storage unit;
Searching, by the server, the evidence data collected at the time of cyber attack by accessing the storage unit based on the summary data summarizing each of the entire packet data, the flow data, and the PE file;
The server extracts an attack time and an attacked IP address based on the found hash value, the temporarily stored total packet data, the flow data, and the PE file, and based on the extracted information, an attack scenario is extracted. Constructing; And
Reproducing, by the server, the breach incident according to the configured attack scenario through a GUI
Evidence data collection method for a cyber infringement incident further comprising.
The method of claim 1, wherein the collecting step,
And storing the extracted entire packet data, the flow data, and the PE file in the buffer in units of a predetermined collection time.
The method of claim 1, wherein the bundle of packet data is
Evidence data collection method for cyber infringement, characterized in that the file in PCAP (packet capture) format.
4. The method of claim 3, further comprising encoding the extracted full packet data, the flow data, and the PE file temporarily stored in the buffer.
The encoding step,
Evidence data collection method for cyber infringement incident, characterized in that encoded in the file unit.
The method of claim 1, wherein the storing step,
And storing the evidence data in the storage unit supporting a write once read many (WORM) function.
The method of claim 1, wherein the storing step,
And storing the meta data of the PE file in the storage unit.
In the cyber black box system for collecting evidence data on cyber infringement, and analyzing the cause of the cyber infringement based on the collected evidence data,
A data collector configured to collect entire packet data, flow data, and PE (Portable Executable) file from the monitored network traffic; And
A server for analyzing the cause of the cyber infringement incident and reproducing the cyber infringement incident based on the collected total packet data, flow data, and PE file,
The server,
Based on the collected packet data, flow data and PE file, the attack time and the attacked IP address are extracted, the attack scenario is configured based on the extracted information, and the cyber breach incident is generated according to the configured attack scenario. Cyber black box system that reproduces through the GUI.
The method of claim 7, wherein the data collection unit,
A packet extracting unit extracting entire packet data from the monitored network traffic;
A flow data extracting unit extracting packet data having the same characteristics as flow data by analyzing the extracted packet data for each IP, port and protocol;
A PE file extracting unit for extracting packet data having a PE (Portable Executable) format from the extracted entire packet data into a PE file; And
And a storage unit for storing the entire packet data, the flow data, and the PE file as the evidence data.
The method of claim 8, further comprising an encoding unit for encoding the extracted full packet data, the flow data and the PE file,
The storage unit,
And storing the encoded full packet data, the flow data, and the PE file.
The method of claim 8, wherein the storage unit,
Cyber black box system characterized by a storage medium that supports the WORM (Write Once Read Many) function.
The cyber black box system of claim 8, further comprising a buffer configured to temporarily store the extracted entire packet data, the flow data, and the PE file in units of a predetermined collection time.
The method of claim 11, wherein the storage unit,
The cyber black box system, characterized in that for storing the entire packet data, the flow data and the PE file temporarily stored in a predetermined collection time unit in the buffer.
The method of claim 8, wherein the storage unit,
And storing the entire packet data, the flow data, and the PE file in a file having a packet capture (PCAP) format.
The cyber black box system of claim 8, further comprising a hash value generator configured to generate a hash value by applying a hash function to each of the extracted entire packet data, the flow data, and the PE file.
The method of claim 14, wherein the storage unit,
The cyber black box system, characterized in that for storing the hash value as evidence data.

Images